CCNA Network Services and Security Practice Question
Exhibit
R1# show running-config | section ip domain ip domain lookup ip domain name internal ip name-server 192.0.2.53 ip name-server 203.0.113.53 ! R1# show ip dns DNS lookup enabled Default domain: internal Name-server list: 192.0.2.53 (unreachable) 203.0.113.53 R1# nslookup webserver.internal Server: 203.0.113.53 Address: 203.0.113.53#53 ** server can't find webserver.internal: NXDOMAIN R1# nslookup 192.168.10.50 Server: 203.0.113.53 Address: 203.0.113.53#53 50.10.168.192.in-addr.arpa name = mail.internal. R1# dig @203.0.113.53 example.com ; <<>> DiG 9.11.3 <<>> @203.0.113.53 example.com ;; connection timed out; no servers could be reached
You are connected to R1, a router that serves as the DNS resolver for the local network 192.168.10.0/24. Users report that they cannot resolve the hostname 'webserver.internal' to its IP address (192.168.10.50), and reverse DNS lookups for that IP return a different name. Additionally, some queries to an external domain 'example.com' time out. Diagnose and fix the DNS configuration on R1 using nslookup and dig commands where applicable, ensuring proper forward and reverse resolution for internal hosts and reachability to external DNS servers.
⚠ Common exam trap
Watch out for questions that present multiple DNS issues simultaneously. Candidates often focus on one problem (e.g., missing A record) and forget to check reverse DNS or external server reachability. Always verify all symptoms before concluding the fix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the unreachable DNS server 192.0.2.53, add an A record for webserver.internal (192.168.10.50), and correct the PTR record for 192.168.10.50 to point to webserver.internal.
The DNS server 192.0.2.53 is unreachable, causing timeouts for external queries. The primary DNS server 203.0.113.53 returns NXDOMAIN for 'webserver.internal' because no A record exists for that hostname in the internal zone. Additionally, the PTR record for 192.168.10.50 incorrectly points to 'mail.internal' instead of 'webserver.internal'. To fix, first remove the unreachable DNS server with 'no ip name-server 192.0.2.53' or replace it with a reachable one. Then, on the DNS server (or via static host entries on R1), add an A record for webserver.internal (192.168.10.50) and correct the PTR record to point to webserver.internal. Optionally, configure 'ip host webserver.internal 192.168.10.50' on R1 for local resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the unreachable DNS server 192.0.2.53, add an A record for webserver.internal (192.168.10.50), and correct the PTR record for 192.168.10.50 to point to webserver.internal.
Why this is correct
This is correct because it addresses all three issues: the unreachable DNS server causes timeouts for external queries, the missing A record prevents forward resolution of webserver.internal, and the incorrect PTR record causes reverse DNS to return the wrong name. Removing or replacing the unreachable server restores external resolution, while adding the A record and fixing the PTR record ensures proper internal resolution.
- ✗
Add an A record for webserver.internal (192.168.10.50) and correct the PTR record for 192.168.10.50 to point to webserver.internal, but leave the unreachable DNS server 192.0.2.53 in the configuration.
Why it's wrong here
This is incorrect because leaving the unreachable DNS server 192.0.2.53 in the configuration will continue to cause timeouts for external queries like example.com. The router will attempt to query that server first or in parallel, leading to delays or failures.
- ✗
Remove the unreachable DNS server 192.0.2.53 and add an A record for webserver.internal (192.168.10.50), but do not correct the PTR record for 192.168.10.50.
Why it's wrong here
This is incorrect because while it fixes the external timeout and forward resolution, it leaves the reverse DNS mapping wrong. Reverse DNS lookups for 192.168.10.50 will still return 'mail.internal' instead of 'webserver.internal', which can cause issues with applications that rely on reverse lookups (e.g., SMTP, logging).
- ✗
Replace the unreachable DNS server 192.0.2.53 with a reachable one, and correct the PTR record for 192.168.10.50 to point to webserver.internal, but do not add an A record for webserver.internal.
Why it's wrong here
This option is incorrect because while replacing the unreachable DNS server with a reachable one restores external resolution (e.g., example.com) and correcting the PTR record fixes reverse lookups, it completely omits the required forward A record for webserver.internal. Without an A record, a DNS query for webserver.internal returns NXDOMAIN, so internal clients cannot resolve the hostname to 192.168.10.50. A PTR record only maps an IP address back to a name; it does not enable forward name-to-address resolution. Both the forward and reverse records must exist to make the device properly reachable by name.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Remove the unreachable DNS server 192.0.2.53, add an A record for webserver.internal (192.168.10.50), and correct the PTR record for 192.168.10.50 to point to webserver.internal.Correct answer▾
Why this is correct
This is correct because it addresses all three issues: the unreachable DNS server causes timeouts for external queries, the missing A record prevents forward resolution of webserver.internal, and the incorrect PTR record causes reverse DNS to return the wrong name. Removing or replacing the unreachable server restores external resolution, while adding the A record and fixing the PTR record ensures proper internal resolution.
✗Add an A record for webserver.internal (192.168.10.50) and correct the PTR record for 192.168.10.50 to point to webserver.internal, but leave the unreachable DNS server 192.0.2.53 in the configuration.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that an unreachable DNS server must be removed or replaced to resolve external queries; simply fixing internal records does not address the timeout issue.
Why candidates choose this
Candidates might think that fixing the internal records is sufficient and overlook the external server issue, or they may assume the router will automatically skip the unreachable server.
✗Remove the unreachable DNS server 192.0.2.53 and add an A record for webserver.internal (192.168.10.50), but do not correct the PTR record for 192.168.10.50.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that reverse DNS must match the forward record for consistency; an incorrect PTR record is a problem even if forward resolution works.
Why candidates choose this
Candidates might think reverse DNS is less important or that the PTR record is automatically updated when an A record is added, which is not true.
✗Replace the unreachable DNS server 192.0.2.53 with a reachable one, and correct the PTR record for 192.168.10.50 to point to webserver.internal, but do not add an A record for webserver.internal.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that forward and reverse DNS are independent; adding a PTR record does not create an A record. The A record must exist for forward queries to succeed.
Why candidates choose this
Candidates might assume that fixing the PTR record also creates the A record, or that reverse DNS is sufficient for name resolution, which is a common misconception.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.